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ABSTRACT 


The effects of maritime mishaps, which include loss of life as well as environmental 
and economic considerations, are significant. It has been estimated that over 80 percent of 
maritime accidents are at least partially attributable to human error. Human error has been 
extensively studied in a number of fields, particularly aviation. The present research 
involves application of the Human Factors Accident Classification System (HFACS), 
developed by the Naval Safety Center, to human error causal factors identified in selected 
investigation reports of significant mishaps occurring on U.S. Navy afloat and diving units 
from 1992 to 1996. An evaluation of the reliability of the classification system was 
performed by measuring the level of agreement between two independent raters’ 
application of the system to mishap analysis. Descriptive statistics and categorical data 
analysis were performed and meaningful insights were revealed regarding the types of 
human error that were associated with afloat naval mishaps. Comments and 
recommendations regarding implementation of the classification system for use in maritime 


accident analysis are provided. 
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EXECUTIVE SUMMARY 


The effects of maritime mishaps, which include loss of life as well as 
environmental and economic considerations, are significant. It is estimated that a 80 
percent of maritime accidents are at least partially attributable to human error. Human 
error has been extensively studied in a number of fields, particularly aviation. The 
present research involves evaluation of a taxonomy, called the Human Factors Accident 
Classification System (HFACS), for applicability, reliability, and usefulness in the post 
hoc analysis of mishap investigation reports of 46 significant mishaps (i.e., involving a 
fatality, permanent disability, or equipment damage exceeding $1 million) that occurred 
on U.S. Navy ships and submarines between 1992 and 1996. HFACS was developed by 
personnel at the Naval Safety Center in Norfolk. Virginia, as an application of existing 
human error theories to accident investigation and analysis. This system had already 
been adopted by the U.S. Navy and Marine Corps for use in aviation mishap investigation 
and analysis. 

The research determined that the taxonomy supported classification of over 90 
percent of 496 causal factors cited in the reports. The remaining causal factors involved 
material and environmental issues. The reliability of the taxonomy for use in ship and 
submarine mishap analysis was evaluated by comparing the level of agreement between 
two judges with equivalent understanding of HFACS as they independently classified the 
mishaps os the taxonomy. Agreement between the two judges was determined to be 


good. 


X1il 











Differences in causal factor classification between the judges were resolved by 
consensus and the resulting classifications were used for subsequent exploratory data 
analysis. This analysis consisted of sorting the data by mishap types (fatality, 
collision/grounding, or other equipment damage) and ship type (carrier, combatant, 
auxiliary, amphibious, and other). Fatal mishaps were further sorted by type (general, 
diving, maintenance, or man-overboard). Each mishap had instances of the different 
error types, and the percentages of mishaps with each of the error types were determined. 
A significant difference was found between the types of errors cited in mishaps involving 
fatalities and those involving equipment damage only. Conversely, differences between 
mishap causal factors types with respect to mishap unit fleet origin, physical location 
(1.e., at sea or in port), and mishap time of day were not found to be significant. 

The research concluded that HFACS was indeed useful in the analysis of ship and 
submarine mishaps and the information provided by the application of HFACS for 
mishap causal factor classification should support development of improved mishap 
prevention strategies. Recommendations for improving the reliability of classifications 
include providing more training regarding the taxonomy to personnel applying HFACS to 
mishap analysis, changing the applicable mishap reporting instructions and directives to 
reflect the concepts of the human error taxonomy, and encouraging investigating boards 
to more clearly address ie human error issues in their reporting of mishap causal factors. 
Additionally, the application of HFACS in the analysis of high-interest mishaps, 
including electrical shock, back injury, and toxic substance exposure, should be 


aggressively pursued. 
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I. INTRODUCTION 


A. OVERVIEW 





The effects of maritime mishaps, which include loss of life as well as 
environmental and economic considerations, are significant. It has been estimated that 
over 80 percent of the mishaps were at least partially attributable to human error (Perrow, 
1984). The story of the Titanic, in which the ship collided with an iceberg and 
subsequently sank with nearly 1500 passengers drowned, is a classic case study in human 
error (Ibid.). One notable fact concerning this disaster is that the captain was 
overconfident in the ship's seaworthiness and carelessly sailed at night into frigid waters 
and through a field of icebergs. The active failure of the captain's decision-making was 
compounded by two latent conditions. The designers thought that no more than three 
compartments could ever be damaged at once; however, five were torn open during the 
collision. Additionally, the threat of sinking was so underestimated that lifeboat space 
was provided for fewer than half the passengers. The ship's capacity was an estimated 
2,200 people but it had, incredibly, only 16 wooden lifeboats designed to carry 65 people 
each, and an additional four, smaller, canvas-sided lifeboats. 

As an another example, most people in the United States today are probably 
familiar with the 1989 grounding of the supertanker Exxon Valdez onto Bligh Reef in 
southern Alaska's Prince William Sound (Witteman, 1990). This mishap resulted in the 
spilling of 11.2 million gallons of crude oil into the sea with a considerable cost to local 
wildlife and environment. The active failure was determined to be that the ship did not 


promptly return to its assigned transit channel following a routine ice-avoidance 


maneuver. The highly publicized investigation speculated that the ship's captain was 
intoxicated at the time of the accident, a latent condition that set the stage for the active 
failure that caused the mishap. 

Human error has been extensively studied in many contexts, with perhaps the 
largest area being aviation. Generally described as "pilot error," human error 
contributing to aviation accidents has been the primary focus of much research by 
military and civilian organizations (O'Hare, Wiggins, Batt, & Morrison, 1994; Shappell 
& Wiegmann, 1997a,b). Considerable human error research has also been conducted in 
other areas of transportation, including highway accidents (Brown, 1990; Fuller, 1990; 
Lourens, 1990; Malaterre, 1990; Parker, Reason, Manstead & Stradling, 1995). In all 
these studies, many methodologies for describing and classifying/partitioning the 
observed human errors have been proposed and used to analyze the accidents. 

In 1974, the National Research Council (NRC), the research arm of the National 
Academy of Sciences (NAS), commissioned a study on “Human Error in Merchant 
Marine Safety." Their study involved interviews and a questionnaire of over 500 
seagoing personnel in an effort to determine the underlying causes of casualties resulting 
from human error in the U.S. merchant marine (NAS Maritime Transportation Research 
Board Commission (MTRB) on Sociotechnical Systems, 1976). They concluded that the 
tolerances for human error had decreased significantly with the introduction of large, fast, 
and highly sophisticated ships and that the consequences of human error had become 
greater. The commission also noted that though the chances and consequences of 
casualties had increased dramatically, the means for countering human error in vessel 


operations had not kept pace. 








The MIRB Commission further identified 14 factors that were either major or 


potential causes of casualties or near-casualties (NAS MTRB Commission on 


Sociotechnical Systems, 1976): 


1. 


Zz 


10. 
11. 
12. 
LS: 


14. 


Inattention 


Ambiguous pilot-master relationship 


. Inefficient bridge design 


Poor operational procedures 


. Poor physical fitness 


Poor eyesight 

Excessive fatigue 

Excessive alcohol use 
Excessive personnel turnover 
High level of calculated risk 
Inadequate lights and markers 
Misuse of radar 

Uncertain use of sound signals 


Inadequacies of prescribed navigation rules 


The Commission's recommendations addressed each of these factors, and each was 


directed at the government agency considered most appropriate for the action required -- 


the Maritime Administration or the U.S. Coast Guard. They also determined that the 


merchant marine casualty database maintained by the U.S. Coast Guard and other 


agencies was inadequate for casualty analysis. The impact of this effort could not be 


determined. 





As recently as 1996, the NRC Commission on Human Performance, 
Organizational Systems, and Maritime Safety held a symposium to examine the issues of 
maritime safety. The Commission had safety experts from the aviation, nuclear power, 
and petrochemical industries, the National Transportation Safety Board, and the Federal 
Aviation Administration, among others, discuss safety practices and interventions used to 
combat human error in their areas. It was clear from the meeting that many of the 
processes currently used in other industries would fit in combating maritime human 
factors problems (J. K. Schmidt, personal communication, April 28, 1998). 

B. BACKGROUND 

The Naval Safety Center, which is located at the Norfolk Naval Air Station, 
Virginia, has three directorates: aviation, afloat, and shore safety, and five support 
departments. Each directorate works independently to help the Chief of Naval 
Operations and the Commandant of the Marine Corps prevent operational mishaps, 
promote safety, and monitor safety programs. The Naval Safety Center (NSC) staff 
collects, evaluates and distributes information about operational and occupational 
mishaps. The command maintains a computerized repository for reports about injuries, 
occupational illness and property damage, and publishes statistical data from those 
reports. Other staff members assist directly or indirectly in investigations into hazards 
and mishaps; the goal is to recommend policies that will prevent similar mishaps and 
control known hazards. Naval Safety Center personnel also conduct safety inspections 
and surveys at operational commands to evaluate the commands' safety programs and 


practices and make recommendations for improvements (Naval Safety Center, 1997a). 








Over the last three years, personnel in the Naval Safety Center’s Aviation Safety 
Programs Directorate have adopted and developed a mishap causal factor coding system 
to examine human error patterns in aviation-related mishaps. The current version of the 
human error taxonomy is called the Human Factors Accident Classification System 
(HFACS). To date, this analytic effort has been primarily limited to Class A flight 
mishaps attributed to aircrew error. The current effort has revealed that the classification 
model works well to describe the human error causal factors, and it is anticipated that the 
mishap prevention strategies based on these analyses will lead to reductions in the 
frequency of these types of mishaps. Plans currently exist to extend the analysis to 
maintenance-related mishaps and aviation mishaps of less severity and different 
classifications, as well as those in other operational communities (J. K. Schmidt, personal 
communication, March 9, 1998). 

Cc. OBJECTIVE STATEMENT 

The purpose of this study is to evaluate the HFACS taxonomy's ability to support 
the human error analysis of naval afloat mishaps (i.e., those involving ships and 
submarines). The objective is to use this model to support the development of 
intervention strategies which may reduce the frequency of future mishaps. 

D. PROBLEM STATEMENT 

Declining defense budgets and reductions in force structure are proving to be the’ 
hallmark of the 1990s for the U.S. military. In many service units, operating tempo has 
not diminished commensurate with the shrinking force size, and many of these units are 


often required to do “more with less.” The combat readiness of the U.S. military has 











become a highly politicized issue and military leaders must give careful consideration to 
the maintenance of the readiness and numbers of military forces (Spence, 1997). 

One requirement for combat readiness is to keep the equipment in good operating 
condition and minimize the occurrence, duration, and cost of repairs of damage caused by 
safety mishaps. The Navy unnecessarily spends millions of dollars each year as a result 
of accidental damage, fatalities, and injuries (Naval Safety Center, 1997b). In 1996, the 
estimated cost of damages to the government from mishaps involving surface ships and 
submarines was almost $28.8 million. These mishaps included five fatalities and 
permanent disabilities, and the cost does not include lost work days or the cost of medical 
treatment. Mishaps seriously degrade operational readiness and waste tax dollars. 
Mishap prevention depends on hazard identification, elimination, control, and correction. 
The Navy, therefore, has a significant interest in developing tools to further the mishap 
prevention effort. 

Personnel limitations at the Naval Safety Center have prevented aggregated 
analysis of data relating to significant mishaps on afloat navy units. Analysis and 
recommendations resulting from investigations of these mishaps have typically been 
reactive in approach and, though the vast majority of causal factors identified were 
attributed to human error, no systematic analysis based on contemporary theories of 
human error has been conducted (J. Sokolowski, personal communication, November 18, 
1997). 

Given the need to address afloat mishaps in a systematic fashion, an effective 
adaptation of HFACS must be undertaken. This thesis research will investigate the 
following issues: (1) Whether the current HFACS taxonomy is applicable to the analysis 
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of afloat mishaps; (2) Whether HFACS is a reliable method for classifying and analyzing 
afloat mishaps; and (3) Whether the classification of afloat mishap causal factors using 
HFACS provides useful information and insights for understanding the mishap causes. 
E. SCOPE AND LIMITATIONS 

Due to the limited availability of mishap data suitable for human error analysis, 
only Class A afloat mishap investigation board (MIB) reports from 1992 through 1996 
will be examined. MIBs are typically not convened to investigate mishaps in which 
either suicide or equipment failure not attributable to human error was clearly evident as 
the primary cause; therefore, Class A mishaps of this nature are not included in the 


analysis. The remaining research database consisted of 46 mishap reports. 





Il. LITERATURE REVIEW 


A. OVERVIEW 

The review of literature for this research included published textbooks covering 
the subjects of human factors, safety and accident prevention. Topics investigated 
encompassed human error, maritime safety, maritime accidents, accident analysis, and 
accident prevention. 
B. HUMAN ERROR 

1. Definition 

Stramler (1993) defined human error as: 

An inappropriate response by a system, whether of commission, omission, 

inadequacy or timing; any discrepancy between an observed or calculated 

value, and the expected value, or a value known to be correct. (p. 104) 
Senders and Moray (1991) described error as "any significant deviation from expectation, 
depending on statistical criteria or experience of normal performance standards," and 
human error is distinguished as a “deviation from expected human performance" (pp. 20- 
21). Reason (1990) provided a working definition for error: 

Error will be taken as a generic term to encompass all those occasions in 

which a planned sequence of mental or physical activities fails to achieve 

its intended outcome, and when these failures cannot be attributed to the 

intervention of some chance agency. (p. 9) 
Reason's definition will serve as the working definition of human error for the remainder 
of this analysis. 

2. Causes of Human Error 


Understanding the causes of human error is a logical first step in any effort to 


reduce their occurrence; however, cause is a very elusive concept. Heinrich, Peterson 


9 





and Roos (1980) contended that errors resulting in accidents could often be attributed to 
negative character traits of the individual which were either inherited or acquired as a 
result of the social environment. Through his study of over 75,000 industrial accident 
reports, he developed ten statements he called Axioms of Industrial Safety that he said 
should be considered by those who wish to prevent accidents. Goetsch (1996) 
paraphrased the axioms as follows: 


1. Injuries result from completed series of factors, one of which is the 
accident itself. 

2. An accident can only occur as the result of an unsafe act by a person 
and/or a physical or mechanical hazard. 

3. Most accidents are the result of unsafe behavior of people. 

4. Anunsafe act by a person or an unsafe condition does not always 
immediately result in an accident/injury. 

5. The reason that people commit unsafe acts can serve as helpful guides 
in selecting corrective actions. 

6. The severity of an accident is largely fortuitous and the accident that 
caused it is largely preventable. | 

7. The best accident prevention techniques are analogous with the best 
quality and productivity techniques. 

8. Management should assume responsibility for safety since it is in the 
best position to get results. 

9. The supervisor is the key person in the prevention of industrial 
accidents. 

10. In addition to the direct costs of an accident (i.e., compensation, 

liability claims, medical costs, and hospital expenses) there are also 
hidden or indirect costs. (p. 34) 


Assuming that the person responsible for an unsafe act did not intend to be unsafe, then 
the need to identify the cause for the behavioral error is critical for prevention. 

Heinrich et al. (1980) established the idea that accidents cannot be attributed to a 
single cause. Additionally, errors must be distinguished from accidents, which may be 
thought of as a manifestation or possible result of one or more errors. An error can have 


a multitude of causes, and they can be related with one another in a variety of causal 
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chains. Senders and Moray (1991) stated that what is deemed to be the cause of an 
accident or error can depend on the purpose of the investigation, with no real, absolute 
cause. 

More contemporary theories of human error consider the causes of human error to 
be the result of a mismatch between the system demands on human performance and 
actual human capability (Rasmussen, 1987a). Many errors that people commit in 
operating systems result from bad design or bad organizational structure rather than 
irresponsible action (Norman, 1988; Reason, 1990, Wickens, 1991). Perrow (1984) 
described the idea that although human error in accident analyses may be statistically 
defined as a contributing factor to an accident, the error itself is only one item ina 
complex chain of breakdowns, some of them mechanical, that affected the system and 
weakened its defenses. 

3. Classifying and Understanding Human Error 

There are several theoretical models of error, each of which takes a different 
perspective on classifying errors. Swain and Guttmann (1983) used what they call a 
simple discrete-action classification model consisting of four categories: Errors of 
commission, omission, sequence, and timing. Errors of commission involve performing 
an act incorrectly. Errors of omission involve failure to do something. A sequence error 
occurs when an individual performs some task, or step in a task, out of sequence. A 
timing error occurs when an individual fails to perform an action within an allotted time, 
performing either too fast or too slow. 

Norman and Lewis (1986) proposed dividing errors into two categories: mistakes 
and slips, which are distinguished by level of intention. A person establishes an intention 
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to act, and if the intention is not appropriate, the error is classified as a mistake. If the 
person's action is not what was intended, the error is classified as a slip. They 
acknowledge that it is possible for both to occur simultaneously. Whereas the previous 
model involved task classification, this model addressed operator intentions. 

Rasmussen (1987b) described error types in terms of psychological mechanisms 
that are being employed by an individual when an error is committed. He identified three 
levels of cognitive control related to decreasing familiarity with a situational 
environment: skill-, rule-, and knowledge-based behavior. Skill-based behavior 
represents sensory-motor performance during an act or activity which tales place without 
conscious control in a smooth, automated manner once the decision to act is made. Rule- 
based behavior is characterized as the combination of a sequence of actions in a familiar 
work situation that is controlled by a stored rule or procedure that the individual 
previously learned to be useful in the currently perceived situation. At the lowest level of 
situational familiarity is knowledge-based behavior, where no know-how or rules are 
known that apply to a situation, forcing an individual to analyze the environment and 
devise an appropriate response. This approach steps beyond operator intentions and deals 
with levels of cognitive processing. 

Nagel (1988) suggested that most of the possible causes of human error in the 
airline cockpit could be described by a three-stage information-processing model of 
human performance. These stages were labeled: (1) information, involving acquiring, 
exchanging, communicating and processing that information; (2) decision, involving 


considering of alternatives and planning a course of action; and (3) action, involving 
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executing of the chosen plan. Both Nagel and Rasmussen were concerned with the stage 
of cognitive processing at the time of error occurrence. 

Wickens and Flach (1988) described another information processing model for 
representing human error. An individual is confronted with a stimulus and either 
correctly or incorrectly interprets the stimulus, then develops either a correct or incorrect 
plan of action, and finally, either correctly or incorrectly execute the plan. They 
classified errors of interpretation or choice of plan as mistakes. Executing the incorrect 
action with a correct plan, or vice versa, is classified as a slip. Their model is similar to 
Nagel's model, but adds Norman and Lewis' concepts of slips and mistakes. 

Reason (1990) developed a model of unsafe acts that classified errors according to 
whether or not the act underlying the decision process was unintentional or intentional. 
In his scheme, unintentional acts are comprised of two error types: slips and lapses. Slips 
are errors resulting from attention failures. An example would be driver who mistakenly 
signals to turn left when a right signal is intended. Lapses are errors resulting from 
memory failures. An example would be a driver who forgets to signal at all when 
initiating a turn. 

Intentional acts consist of two more error types called mistakes and violations. 
Mistakes are classified as either rule-based or knowledge-based. Rule-based mistakes 
result from the application of a previously learned rule that was either misapplied or was 
inappropriately learned. Knowledge-based mistakes can occur when an individual is 
confronted with a situation for which they have no previously learned rule to refer to and 
the response they derive analytically is inappropriate. Violations, though not strictly an 
error type, represent unsafe behavior demonstrated by willful disregard of rules and 
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regulations. Violations can lead to errors and are broken down into two types. Routine 
violations are those that are typically tolerated by an organization, whereas exceptional 
violations are significant deviations from acceptable practice (Reason, 1990). A person 
driving ten miles per hour over the speed limit may be committing a routine violation. A 
person driving 60 miles per hour over the speed limit, however, is likely committing an 
exceptional violation. 

Reason (1995) later proposed a theory of accident causation that described how 
human failures, latent or active, contribute to system breakdowns. Latent failures can 
occur within the upper levels of an organization or at the immediate human-system 
interface and are created by people who are often remote in both time and space from the 
hazards. Active failures, in contrast, are committed by those at the immediate human- 
system interface and hazard environment. His model described two interrelated causal 
sequences: (a) an active failure pathway that originates in top-level decisions and 
proceeds via error-producing and violation-promoting conditions in the various 
workplaces to unsafe acts committed by those at the immediate human-system interface, 
and (b) a latent failure pathway that runs directly from the organizational processes to 
deficiencies in the system defenses. 

Shappell and Wiegmann (1997a), using the models of human error by Rasmussen, 
Wickens and Flach and Reason, analyzed Naval aviation mishaps. Their objective was to 
examine the utility of these different theoretical frameworks for analyzing aviation 
accidents and to determine if this provided additional insight into the types of error 
associated with the aviation mishaps. Their success led them devise a new classification 
system for human error in aviation mishaps: the Taxonomy of Unsafe Operations 
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(Shappell & Wiegmann, 1997b). The most recent version of the taxonomy was renamed 
as the Human Factors Accident Classification System (HFACS). 

HFACS describes three levels of failure within the human component of Reason's 
(1990) human error model: (1) unsafe supervision; (2) unsafe conditions of the operator; 
and (3) unsafe acts committed by the operator. HFACS (Shappell & Wiegmann, 1997b) 
focuses on failures committed by supervisors as they relate to the psychological and 
physical condition of the aircrew (latent failures) and ultimately the unsafe acts the 
aircrews commit (active failures). The objective of the system is to identify failures 
within each level that have caused mishaps in the past and attempt to prevent their future 
occurrence. The following paragraphs provide a summary of the HFACS categories 
(Shappell & Wiegmann, 1998). 

Unsafe supervision refers to supervisory acts that either directly or indirectly 
contributed to a mishap, and consists of unforeseen unsafe supervision and known unsafe 
supervision (Reason, 1990). Unforeseen unsafe supervision describes unsafe 
management or supervisory practices that go unnoticed and are not the result of 
negligence or adverse behavior. Subcategories of unforeseen unsafe supervision include: 
(1) unrecognized hazardous operation; (2) inadequate documentation; and (3) inadequate 
design. An example of an unrecognized hazardous operation would be assignment of a 
person who just experienced a death in the family to a potentially hazardous task. 
Inadequate documentation and design refer to documents or designs, specified by or the 
responsibility of management at a higher organizational level than the affected command, 


which contributed to the mishap occurrence. 
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Known unsafe supervision describes failures within the supervisory chain of 
command that is the direct result of some action or inaction. Subcategories of known 
unsafe supervision include: (1) inadequate supervision; (2) planned inappropriate 
operations; (3) failure to correct known problems; and (4) supervisory violations. 
Inadequate supervision accounts for instances where supervision proves to be 
inappropriate or absent. Planned inappropriate operations involves instances where 
improper personnel scheduling and operational planning puts operators at unacceptable 
risk due to the adverse impact on crew rest and crew pairings. Failure to correct known 
problems refers to instances where deficiencies among individuals, equipment, training , 
or other safety-related area are known by the supervisor yet continue to go uncorrected. 
Supervisory violations are those instances in which supervisors willfully disregard rules 
and regulations when managing assets. 

Unsafe conditions of the operator can contribute to or cause unsafe acts (Reason, 
1990), and is further broken down into the categories medical conditions of the operator, 
crew resource management, and personnel readiness. Medical conditions consist of 
three subcategories. Adverse physiological states account for those medical or 
physiological conditions that affect safe operation. Adverse mental state refers to 
psychological or mental conditions that negatively impact performance. Physical or 
mental limitation addresses instances when necessary sensory information is not 
available, or operators do not have adequate ability or time to solve a problem. Crew 
resource management refers to poor coordination and communication between operators 
or watch-teams. Readiness violations refer to violations of rules that adversely impact 
personnel performance. 


16 ° 











The final major category of HFACS, unsafe acts of the operator, consists of 
errors and violations and are derived largely from Reason's (1990) work. Errors are 
defined as mental or physical activities that fail to achieve their intended outcome. There 
are three basic error types: perceptual errors, skill-based errors, and decision errors. 
Perceptual errors occur when a situation is misrecognized or the operator's perception is 
not consistent with reality. Skill-based errors are errors in the execution of a response 
that has become highly automated. This type of error includes slips or lapses. Decision 
errors describe situations where intentional behavior proceeds as intended, yet the chosen 
plan or goal proves inadequate to achieve the desired outcome. Decision errors may 
contain either rule-based or knowledge-based errors, as previously described in the 
section on human error classification. Violations committed by the operator consist of 
infractions and exceptional violations. Infractions are typically minor violations that are 
usually tolerated by the organization, whereas exceptional violations are isolated and 
extreme departures from acceptable practice, neither condoned by the organization nor 
typical of the operator. 

HFACS provides a tool for post-mishap analysis that may provide useful 
information to those tasked with developing mishap prevention strategies (Shappell & 
Wiegmann, 1997c). It may also be used to help investigators gain an appreciation for the 
genesis of human error, and the relationship between the conditions of the operators, and 
those who supervise them, and the unsafe acts that directly resulted in the mishap. 
HFACS' cause-oriented approach is also thought to make it useful in a variety of 


occupational settings, not just aviation. Finally, HFACS can be used as a training tool to 
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educate operators and their organizations and thereby increase their awareness of human 
error types and accident causes. 
C. ACCIDENT PREVENTION 
1, Purpose 
The prevention of accidents is clearly a desirable goal in any organization. 
McElroy (1974) stated that a successful accident prevention program involves at least 
four fundamental activities: 
1. A study of all working areas to detect and eliminate or control physical 
or environmental hazards which contribute to accidents; 
2. A study of all operating methods and practices; 
3. Education, instruction, training and discipline to minimize human 
factors which contribute to accidents; 
4. For cause analysis, a thorough investigation of at least every accident 
which results in a disabling injury or lost workdays to determine 
contributing circumstances. (p.151) 
This fourth element, accident investigation and analysis, "is a defense against hazards 
_ that are overlooked in the first three activities, those that are not obvious, or hazards that 
are the result of combinations of circumstances that are difficult to foresee" (p. 150). 


2. Accident Causation 


An implicit assumption of accident analysis has been that if the cause of the 





accident is known, then similar accidents can be prevented in the future (Mayer & 
Ellingstad, 1992; Hill, Byers, Rothblum & Booth, 1994). This is often true when the 
cause of an accident is material in nature; however, accidents caused by human error 
often leave little direct evidence for later analysis. Therefore, accident databases often 
contain more information representing hardware failures, and other directly observable 


phenomena, than human error (Mayer & Ellingstad, 1992). 
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Heinrich et al. (1980) developed one of the earliest theories of accident causation. 
His domino theory stated that injuries result from a series of factors in the sequence of 
events that lead up to an accident: heredity and social environment, faults of a person, 
unsafe acts and/or mechanical or physical hazards, the accident itself, and finally, the 
resulting injury. Two central points of this theory are: (1) injuries are caused by the 
action of preceding factors; and (2) removal of the central factor (unsafe act or hazardous 
condition) negates the action of the preceding factors and thereby prevents the accident. 

A human factors theory of accident causation later described by Heinrich (1980) 
attributed accidents to a chain of events ultimately caused by human error. Three broad 
factors that lead to human error were identified as overload, inappropriate activities, and 
inappropriate responses. Overload refers to an imbalance between a person's task 
capacity at any given time and the task load that person is carrying in a given state. 
Factors that affect capacity include a person's natural ability, training, fatigue, stress, and 
physical condition. Inappropriate activities consist of performing tasks without requisite 
training or misjudging the degree of risk involved with a given task. Inappropriate 
responses consist of detecting but not correcting a hazard, removing safeguards from 
machines and equipment, and ignoring safety. 

The accident/incident theory of accident causation also described by Heinrich 
1980) added new elements to the human factors theory like ergonomic traps, the decision 
to err, and systems failures. In this theory, overload, ergonomic traps, and/or a decision 
to err can lead to human error. Ergonomic traps consist of incompatible workstations 
and incompatible expectations. The decision to err may be unconscious, conscious and 
based on logic, or it may be based on a misjudgment of risk. The systems failure 
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component is a result of these causes of human error and accounts for the potential for a 
causal relationship between management decisions and behavior, and safety. It also 
establishes management's role in accident prevention as well as the broader concepts of 
health and safety in the workplace. 

The epidemiological theory of accident causation developed by Suchman (as cited 
in Heinrich et al., 1980) holds that the models used for studying and determining the 
causal relationships between environmental factors and disease (epidemiology) can also 
be used to study causal relationships between environmental factors and accidents. 

According to this approach, injuries and damage are the measurable 

indices of an accident, but the accident itself is the unexpected, 

unavoidable, and unintentional act resulting from the interaction of the 

victims of the injury or damage deliverer and environmental factors within 

situations which involve risk taking and perceptions of danger. ... In 

applying this approach one seeks an explanation for the occurrence of 

accidents within the host (accident victim), the agent (injury or damage 

deliverer), and environmental factors.... (p.50) 

The key components of these environmental factors are predispositional characteristics 
and situational characteristics. Predispositional characteristics consist of susceptibility 
of people, perceptions, and environmental factors. Situational characteristics include risk 
assessment by individuals, peer pressure, priorities of the supervisor, and attitude. 

M. Edwards (1981) described an approach for conducting accident investigations 
with an emphasis on human factors using a model of accident causation called the SHEL 
system developed by E. Edwards (1972). Three types of system resources, Software 
(procedures and rules), Hardware (machinery), and Liveware (humans) interact together 


within their Environment. M. Edwards wrote: 


The ergonomics approach to accidents is based on the premise that what 
people do in a work situation is determined not only by their capabilities 
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and limitations but also by the machines they work with, the rules and 

procedures governing their activities and the total environment within 

which the activity takes place. ... Accidents, then, are symptomatic of a 

failure in the system and as such provide clues about the location of the 

source of failure, indicating where mismatches occur and what kind of 

action is likely to be effective in reducing these mismatches. (p. 114) 

Shappell and Wiegmann (1997b) add, however, "until human failure is adequately 
described, its complex interactions with other components of the SHEL model cannot be 
fully understood" (p. 271). 

Bird (1974) proposed a sequential theory of accident causation where events 
leading to an accident can be likened to dominos falling. The first domino represents 
management control of accident prevention. Losses at this level permit personal and job- 
related causes (domino two) to appear. These causes are often at the root of the sub- 
standard conditions and practices (domino three) that directly result in an accident 
(domino four), and lastly, personal injury and material damage. Removal of any of the 
first three dominoes may then be expected to interrupt the chain and thereby prevent the 
accident. 

There is often a difference between any theory of accident causation and reality. 
Some accidents may be described by one theory better than by another. Goetsch (1996) 
described a combination theory of accident causation where the actual cause of an 
accident may combine parts of different theories. He maintained that safety professionals 
should use these theories as appropriate for both accident prevention and investigation. 

3. Investigations 


An accident investigation should produce information that leads to 


countermeasures that prevent or reduce the number of accidents (McElroy, 197 4). Mayer 
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and Ellingstad (1992) contend that, in addition to gathering factual information about an 
accident, a human factors analysis should be a major part of an investigation. Human 
factors analysis refers to a "complete accounting of human-equipment interaction in the 
accident situation, and not the 'mental state’ or disposition of the people involved in the 
accident" (p. 965). Task demands placed on the operator and operational requirements of 
the task must be accounted for. "The need for standardization and the realization that not 
all accident investigations will be conducted by professionals in human factors, suggests 
that checklists or other 'cookbook' methods may be needed" (p. 966). 

There are few methodological tools for the analysis of human factors accidents 
(Mayer & Ellingstad, 1992; Edwards, 1981; Pimble & O'Toole, 1982). Many methods 
presented in the literature involve reorganization and analysis of data that has already 
been collected. Adams, Barlow and Hiddlestone (1981) redesigned an injury report for 
use in an fastelian steel-processing plant that included several checklists to elicit clearly 
defined, categorical ergonomics data. They then tracked injury rates over a five-year 
period and observed a dramatic drop in injury frequencies, which they attributed partly to 
the use of the highly informative and detailed report form. They concluded that the 
categorical approach to reporting utilized in their study was of real value, and suggestions 
were made for its more widespread application. 

Andersson and Lagerlof (1983) described changes to the Swedish information 
system on occupational injuries that included implementing a new injury notification 
form that provided a sounder basis for accident prevention measures. They viewed their 
system as an improvement over the previous method of data collection that they 
described as very case-related and useful primarily as an aid for setting fees for work 
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injury insurance. Hill et al. (1994) described a computerized investigation reporting 


system in use by the U.S. Coast Guard which requires investigators to complete standard 
forms containing specific classification schemes to summarize accident information. 
They claimed that the system has provided structure to data collection and consistency 
across investigations. 

4. Reporting 

To be effective, accident reports must be based on complete and unbiased 
information regarding the accident. The primary aim of the accident report is to record 
this information and not to fix blame. Since the accuracy and completeness of any 
accident database is dependent on the quality of each individual accident report, it is 
critical that investigators use a standardized reporting format (McElroy, 1974). 

Accident investigations typically produce a large quantity and variety of data. 
Mayer and Ellingstad (1992) discussed how accident databases frequently describe 
attributes of environment and equipment, but that detailed analysis of accident causes, 
including human factors tihaiiidies: are frequently not represented because they are too 
difficult to obtain and code. If one considers a single accident to be symptomatic of a 
larger organizational safety problem, then analyses into the causes of accidents would 
logically involve consideration of post-accident data. "Databases that do not attempt to 
explain more than factual data are generally of little use to human factors researchers" 
(Mayer & Ellingstad, 1992, p. 966). 

Shappell and Wiegmann (1997b) noted that most accident databases are not 
designed around a theoretical framework of human error. "Indeed, most accident 
reporting systems are designed and employed by engineers and front-line operators with 
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limited backgrounds in human factors" (p. 270). This supported their observation that the 
rates of aviation accidents attributable to material and design factors had decreased 
significantly over the last 20 years, whereas the rates of accidents attributable to human 
error have not dropped a comparable amount. "Resulting post-accident databases are 
therefore not typically conducive to a traditional human error analysis, making the 
identification and development of viable human intervention strategies onerous" (p. 270). 
5. Accident Analysis 

There have been a number of efforts described in the literature where some 
progress was made at extracting causes of accidents from existing databases. Anderson 
(1983) studied shipboard accident reports by sorting the data by location of accident on 
specific ships, and then conducted an ergonomic survey and appraisal of the locations to 
make recommendations for future accident prevention. Studies have been performed on 
slips and falls in a variety of industrial settings (Andersson & Lagerlof, 1983; Leamon & 
Murphy, 1995) and material handling accidents (Pimble & O'Toole, 1982). These studies 
have provided procedures for extracting accident causes from traditional databases. 

Research has been conducted in which post-accident data was reclassified 

according to various theoretical frameworks of human error. Salminen and Tallberg 
(1996) examined the effect of human error on industrial accidents in Finland by 
classifying numerous accidents according to Rasmussen's (1 987b) skill-rule-knowledge 
(SRK) model discussed previously. They found that 84-97 percent of the accidents were 
due to human error with over half the human errors classified as skill-based and in 
general the SRK model worked well. O'Hare, Wiggins, Batt, and Morrison (1994) 
examined human failure in the airline cockpit by recoding data from airline accidents in 
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New Zealand over a ten year period using Nagel's (1988) model as well as several other 
cognitive failure models described therein. They found that aircraft accident reports 
could be a useful source of information about cognitive failures when examined with an 
appropriate, theoretically-based analysis of information processing errors. 
D. SUMMARY 

Numerous theories of human error have been postulated. Reason (1990) provided 
a working definition of error to be all occasions when intended actions fail to achieve the 
intended outcome for reasons other than chance. Causes of human error evolved from 
being a result of negative character traits to the inevitable result of human-system 
performance mismatch. A discrete-action classification model was developed by Swain 
and Guttmann (1983) that included errors of commission, errors of omission, sequence 
errors, and timing errors. Norman and Lewis (1986) proposed dividing errors into the 
categories slips and mistakes, and Rasmussen (1987b) described error types as skill- 
based, rule-based, and knowledge-based. 

Nagel (1988) classified error by the stages of information processing in which 
they occurred: information, decision, and action. Wickens and Flach (1988) used a 
similar information processing model to describe errors as slips or mistakes, depending 
on the stage of processing in which they occur. Reason's (1990) model of unsafe acts 
differentiated between whether the act was intended or not. Unintentional errors were 
called slips and lapses. Intentional acts that resulted in error were called rule-based or 
knowledge-based mistakes or routine or exceptional violations. Reason (1995) later 
presented a theory of accident causation in which he described how active and latent 
failures contribute to system breakdown. Shappell and Wiegmann (1997b) constructed a 
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human error taxonomy using several established theories to classify certain aviation 
mishap causal factors. 

Accident prevention was established as a major organizational goal. Heinrich et 
al. (1980) and Bird (1974) proposed similar domino theories that described an accident as 
being the last item in a chain of events. Bird maintained that elimination of one or more 
"links" of the chain could prevent the accident from occurring. Several other theories of 
accident causation were described and it was noted that some accidents may best be 
described by a combination of them. Accident investigations were described as vital 
tools for collecting information about accident causes, though investigations frequently 
do not uncover the reasons why the identified errors occurred. In general, accident 
databases do not support human factors analysis. Several attempts have met with some 


success at extracting human factors information from existing accident databases. 
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I. METHODOLOGY 


As RESEARCH APPROACH 

This research involved analysis of an existing database of mishap reports 
maintained by the U.S. Navy. These mishap reports cite causal factors contributing to the 
mishap occurrence as identified by the investigating board. These causal factors were 
evaluated independently by two judges and the human error factors were classified 
according to an existing taxonomy of human error types. Both judges were professional 
naval officers with roughly sixteen years experience each and extensive knowledge of 
HEACS. One was a submarine officer and the other was an experimental psychologist. 
The reliability of the taxonomy was evaluated by comparing the level of agreement 
between the two judges. Differences were resolved and the final classification of all 
human error causal factors served as the data set for subsequent statistical analysis. The 
analysis involved calculating the percentage of mishaps in the various categories that had 
instances of each of the human error types contained in the HFACS taxonomy. Tests for 
significance between types of causal factors in various groupings of the mishaps were 
performed. 
B. DATA COLLECTION 

1. Afloat Mishaps 

A comprehensive review of Navy Class A mishaps involving ships, submarines, 
and diving ani between January, 1992, and December 1996, was conducted using the 
mishap database maintained by the Naval Safety Center, Norfolk, Virginia. The Navy 


classifies a mishap according to the severity of the accident. Class A mishaps involve 
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one or more of the following: (1) a total cost of $1,000,000 or more, (2) a fatal injury, or 
(3) a permanent total disability. Class A mishaps occurring prior to 1992 were not 
reviewed because the information maintained in the electronic database did not contain a 
complete record of mishap causal factors needed for this analysis. 

2. Human Factors Accident Classification System 

The HFACS taxonomy used in this analysis contained categories for classifying 
causal factors and was organized into three levels as shown in Table 1. At the broadest 
level, mishap causal factors are classified as unsafe acts of the operator, unsafe conditions 
of the operator, and unsafe supervision. Levels II and III contain the detailed breakdown 


of the preceding higher level (where applicable). 


LEVEL I 


Unsafe Acts 
Violations 
Unsafe Conditions | Medical Conditions 
Crew Resource Management 
Personnel Readiness 
Unsafe Supervision | Unforeseen Unsafe Supervision 
Known Unsafe Supervision 


Table 1. Human Factors Accident Classification System Taxonomy. 















Perceptual 
Skill-Based 
Decision 






Infraction 
Exceptional Violation 





Adverse Physiological State 
Adverse Mental State 
Physical/Mental Limitation 











Crew Resource Management 


Personnel Readiness 








Unrecognized Hazardous Operation 
Inadequate Documentation 
Inadequate Design 


















Inadequate Supervision 
Planned Inappropriate Action 
Failure to Correct Problem 
Supervisory Violation 
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3. HFACS Procedure 


Copies of the each of the final mishap investigation board reports, including 
comments from all endorsements by the chain of command, were provided to two judges. 
Each human error causal factor cited in the mishap reports was independently classified 
by the two judges according to which one of the 17 taxonomy codes identified in Table 1 
they considered best reflected the causal factor description. All classification differences 
between the judges were unanimously resolved yielding a single classification of each of 
the causal factors. 

4. Ten-Year Class A Mishap History 

Though only 46 mishap reports were available for detailed HFACS analysis, the 
dates of afloat Class A mishaps over the period 1987 through 1996 were extracted from 
the electronic database at the Naval Safety Center. Additionally, the number of 
commissioned ships over this period was collected to allow analysis of mishap rates. 

C. DATAANALYSIS 

1. Data Tabulation 

The occurrence of one or more instance of each error type in each mishap was 
recorded in a spreadsheet. Multiple occurrences of the same error type in a single mishap 
received no more weight than a single occurrence due to the wide variability in length 
and detail of the mishap reports. 

2. Statistical Analysis 

a. Frequency Analysis of Mishaps 
The percentages of mishaps by mishap type and then by ship type were 
determined. Next, the numbers of mishaps by ship type and mishap type were 
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determined. Fatal mishaps were then categorized and the percentages of these categories 
were determined. In order to describe the distribution of causal factor citations in the 
mishaps, the minimum, maximum, and mean number per mishap, as well as the total 
number cited for each mishap type, were determined. 

b. Inter-Rater Agreement 

The reliability of the HFACS taxonomy was evaluated by calculating 
inter-rater agreement between the two judges using Cohen's kappa. Kappa is an index of 
agreement that has been corrected for chance (Fleiss, 1981). Kappa values were 
calculated for the three levels of causal factor classification. Fleiss (1981) characterized 
different ranges of values for kappa with respect to the degree of agreement they suggest. 
For most purposes, kappa values between 0.75 and 1.00 indicate excellent agreement, 
values between 0.40 and 0.75 indicate good agreement, and values below 0.40 indicate 
poor agreement beyond chance. These characterizations were used to evaluate the inter- 
rater agreement at the three different levels of taxonomy classification identified in Table 
Tr. 

Cc. Frequency Analysis of HFACS 

The percentage of mishaps, both in aggregate and by mishap type and ship 
type, which contained at least one causal factor classified in the nine categories in Level 
Il of the taxonomy were determined. Differences between mishap types and by ship type 
were evaluated. 

d. Mishap Group Comparisons 

Each mishap report contained categorical cafgmniation regarding the 
mishap ship which included local time of day of the mishap (day or night), the physical 
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location of the mishap unit (at sea or in port), and the fleet to which the mishap unit was 
assigned (Atlantic or Pacific). Each mishap was grouped into one of two possible 
choices for each of these categories and a test was performed to determine if there was a 
significant difference between the HFACS causal factor "signature" of each dichotomous 
grouping. A permutation test (Sprent, 1989) was performed for this evaluation. An 
extensive discussion of the test is provided in Appendix A. 

é. Ten-Year Mishap Frequency Analysis 

The frequency and rate of all afloat class A mishaps by calendar quarter 
during the period 1987 through 1996 were examined to provide a broader perspective of 
the 46 mishaps analyzed by HFACS. This information may be useful for future 


evaluation of measures initiated as a result of this research. 


3] 


32 











IV. RESULTS 


A. MISHAP DATABASE 

A total of 59 Class A mishaps occurred during the period from January, 1992, 
through December, 1996. Of these 59 mishaps, 46 had mishap investigation board 
reports available for review. Though limited data on all Class A mishaps is maintained 
indefinitely in an electronic database at the Naval Safety Center, a mishap investigation 
report was not available for the remaining 13 mishaps for one of the following reasons: 
(1) a mishap investigation was not conducted because the mishap was determined to be 
due to a material failure only, and not the result of human error; (2) the report had been 
disposed of because of exceeding the Naval Safety Center's retention requirement; or (3) 
the report could not be located. A summary of the database is provided in the Appendix 
B. 

A breakout of maritime class A mishaps by ship types Carriers, Combatants, 
Auxiliaries, Amphibs, and Other is provided in Figure 1. Eleven of the 46 mishaps (24%) 
occurred on aircraft carriers. Fourteen mishaps (30%) occurred on combatants (i.e., 
cruisers, destroyers, frigates, and submarines), and 11 (24%) occurred on auxiliary ships 
(i.e., oilers, ammunition ships, and repair ships). Four mishaps (9%) occurred on 
amphibious-type ships (i.e., helo transport and troop ships). The "Other" category 


represents six mishaps (13%) that occurred on diving units, tugs, and assault craft. 
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Figure 1. Distribution of Mishaps by Ship Type. 


A breakout of the maritime class A mishaps by type is shown in Figure 2. 
Twenty-seven mishaps (59%) reviewed were categorized as fatalities (note: 26 involved 
one or more fatalities and one resulted in a permanent total disability) and 19 (41%) 
involved equipment damage. Of the 19 equipment damage mishaps, 12 involved the 


collision or grounding of a vessel. 
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Figure 2. Distribution of Mishaps by Mishap Type. 


A breakout of the 46 mishaps sorted by ship type and mishap type is shown in 
Figure 3. Auxiliary ships accounted for the largest number of fatal mishaps with nine, 
followed next by carriers with seven; and four fatal diving mishaps and one fatal tug 


mishap fall in the "Other" category. Combatant ships experienced by far the largest 
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number of collisions and groundings with eight. No other ship type had more than two 
collision or grounding mishaps. "Other equipment damage" mishaps were nearly equally 
distributed between the ship types. This category involved three propulsion equipment 


casualties, one fire, one flooding, a lost towed sonar device, and a hydraulic system 
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Figure 3. Distribution of Mishap by Mishap Type and Ship Type. 


The 27 fatal mishaps were distributed into four broad categories shown in 
Figure 4. Ten "General" fatal mishaps (36%) occurred involving fires, forklift operation, 
line-handling, material handling, electric shocks, or falls. Five diving mishaps (19%) that 
involved the diver either drowning or experiencing a fatal embolism were analyzed. Five 
fatal mishaps (19%) occurred during scheduled maintenance performance on cargo | 
elevators, CO2 sprinkler systems, and electronic equipment. Seven man-overboard 


mishaps (26%) occurred where the victim was either battered against the ship's hull or 





drowned before being rescued. 
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Figure 4. Distribution of Fatal Mishaps by Type. 


A total of 496 causal factors were cited in the 46 mishaps, and included mishap 
causes relating to human error, material, and environmental factors. The number of 
causal factors cited in each of the mishap reports varied greatly. Table 2 shows the 
frequency of causal factor citations in each of the three mishap categories. The twenty- 
seven fatal mishaps had the lowest mean number of causal factors cited per mishap with 

7.0, while equipment damage mishaps not involving grounding or collision had the 
highest mean of 18.7 causal factors cited per mishap. Collision and grounding mishaps 


were in between these values with a mean of 14.6 causal factors cited per mishap. 





Number of Causal Factors Cited per Mishap 


1 24 7.0 






Number of 
Causal 
Factors Cited 










Fatality (27) 190 
Collision/Grounding (12) 175 3 38 14.6 
Other Equipment Damage (7) 131 4 38 18.7 










Table 2. Distribution of Number of Causal Factors Cited by Mishap Type. 


the mishap unit including to which Navy fleet the unit belonged, the physical location of 


| 
| 
The mishap reports contained information provided in Table 3 that was specific to 
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the mishap unit at the time of the mishap, and the local time of day at which the mishap 
occurred. Twenty-seven of the 46 mishaps analyzed (58.7%) were under the 
responsibility of the Commander In Chief, U.S. Atlantic Fleet (CINCLANTLFT), and the 
remaining 19 (41.3%) belonged to the Commander in Chief, U.S. Pacific Fleet 
(CINCPACFLT). Nineteen of the 46 mishaps (41.3%) occurred while the ship or unit 
was located in port, while the remaining 27 (58.7%) occurred at sea. Thirty-two of the 46 
mishaps (69.6%) occurred during the hours from 0600 to 1800 local time and the 
remaining 14 (30.4%) occurred after normal working hours between 1800 through the 


night until 0600. 


% Collision 


Mishap Unit Facts & Grounding 
(n= 12) 


Fleet Association 
Atlantic 58.7 (27) 59.3 (16) 58.3 (7) 57.1 (4) 
Pacific 41.3 (19) 40.7 (11) 41.7 (5) 42.9 (3) 


Physical Location 
In Port 41.3 (19) 59.3 (16) 0.0 (0) 42.9 (3) 
At Sea 58.7 (27) 40.7 (11) 100.0 (12) 57.1 (4) 


Mishap Time of Day 
Day (0600-1800) 69.6 (32) $1.5 (22) 58.3 (7) 42.9 (3) 


Night (1800-0600) 30.4 (14) 18.5 (5) 41.7 (5) 57.1 (4) 





Table 3. Comparison of Mishaps by Mishap Unit Facts. The number 
represents the percentage of mishaps in the mishap category that corresponds 
to the associated grouping followed by the raw number of mishaps in 
parentheses. 


B. HUMAN FACTORS ACCIDENT CLASSIFICATION SYSTEM 
Using the HFACS taxonomy, 459 (92.5%) of the 496 of the causal factors 


identified in the mishap reports were classified by both judges as human error. The 
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remaining 37 causal factors were classified as being either a material or environmental 
issue. Inter-rater reliabilities for classification of the 459 factors into the various levels of 
the taxonomy (from Table 1) are provided in Table 4. The best agreement between the 
judges was at Level I of the taxonomy (kappa = 0.64), where the causal factors are 
categorized as being an unsafe act, unsafe condition, or unsafe supervision. This "kappa’ 
value represents good agreement between the two judges, as did the values for the other 
two levels. Consensus was reached between the two judges for all differences in 
classification for the 459 causal factors, which became the data set for subsequent 


analysis. 


Taxonomy Level Number of Factors in Level Inter-Rater Reliability 
' (kappa) 
I 3 0.64 
II 7 0.54 
il 17 0.43 


Table 4. Comparison of Inter-Rater Reliability "Kappa" Value by Taxonomy 
Level. 





C. AFLOAT MISHAP HFACS CAUSAL FACTOR CLASSIFICATION 

The distribution of the 459 causal factors over all mishaps at Level IT (seven 
factors) of HFACS is shown in Figure 5. Known supervisory error comprised the largest 
segment with 196 (42.7%) causal factors, followed by the operator error categories with 


104 (22.7%) and crew resource management with 57 (12.4%) causal factors. 
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Figure 5. Distribution of All Mishap Causal Factors at HFACS Level II. 


The distribution of the 459 human error causal factors by mishap type and ship 
type for the 46 mishaps are provided in Tables 5 and 6 respectively. Table 5 shows the 
percentage of mishaps for which reports cited each HFACS causal factor, broken down 
by mishap type. In general, known unsafe supervision was strongly associated with all 
mishaps (all types greater than 66%). Crew resource management errors and inadequate 
supervision were most frequently associated with collisions and groundings (both 
83.3%). Skill-based errors and inadequate supervision were most frequently sociated 
with mishaps categorized as "Other Equipment Damage" (both 85.7%). Inadequate 
supervision and decision errors were most frequently associated with fatal mishaps 


(66.7% and 51.9%, respectively). 
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Taxonomy Causal Factor 


Unsafe Acts 
Perceptual Error 
Skill-Based Error 
Decision Error 
Infraction 
Exceptional Violation 


Unsafe Conditions 
Adverse Physiological State 


Adverse Mental State 
Mental/Physical Limitation 
Crew Resource Management 
Personnel Readiness 


Unsafe Supervision 
Unrecognized Hazardous Ops 
Inadequate Documentation 
Inadequate Design 
Inadequate Supervision 
Planned Inappropriate Actions 
Fail to Correct Problem 
Supervisory Violation 


6.5 (3) 
50.0 (23) 
56.5 (26) 
32.6 (15) 
28.3 (13) 


6.5 (3) 
30.4 (14) 
2.2 (1) 
34.8 (16) 
4.3 (2) 


4.3 (2) 
10.9 (5) 
15.2 (7) 
73.9 (34) 
32.6 (15) 
17.4 (8) 
28.3 (13) 


% Fatality 
(n = 27) 


7.4 (2) 
40.7 (11) 
51.9 (14) 
29.6 (8) 
14.8 (4) 


11.1 (3) 
29.6 (8) 
3.7 (1) 
14.8 (4) 
74 (2) 


74 (2) 
3.7 (1) 
22.2 (6) 
66.7 (18) 
33.3 (9) 
11.1 (3) 
25.9 (7) 


% Collision 
& Grounding 
(n= 12) 





Table 5. Comparison of Mishaps by HFACS Causal Factor Category. The 
number represents the percentage of mishaps in the mishap category that 
contained at least one instance of the corresponding taxonomy causal factor 
followed by the raw number of mishaps in parentheses. 


Table 6 shows the percentage of mishap reports, by ship type, that cited at least 
one instance of a causal factor in the various HFACS taxonomy categories. In general, 
decision errors and inadequate supervision were most closely associated with carriers 
(72.7% and 90.9%, respectively). Decision errors and inadequate supervision were also 
strongly associated with combatants (64.37% and 85.7%, respectively). Skill-based errors 
were most closely associated with the "Other" category (66.7%), consisting of fatal 
mishaps on four diving units and a tug, and an assault craft (LCAC) grounding. All ship 


types had known unsafe supervision cited in well over half of their mishaps. 
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% - . 
(n= 11) 





% 
0 Carri 
Taxonomy Causal Factor a 7 “TS | Combatants 
tia (n= 14) 


Unsafe Acts 
Perceptual Error 
Skill-Based Error 
Decision Error 

Infraction 

Exceptional Violation 
























Unsafe Conditions 
Adverse Physiological State 
Adverse Mental State 
Mental/Physical Limitation 
Crew Resource Management 

Personnel Readiness 






Unsafe Supervision 
Unrecognized Hazardous Ops 
Inadequate Documentation 
Inadequate Design 
Inadequate Supervision 
Planned Inappropriate Actions 
Fail to Correct Problem 

Supervisory Violation 


Table 6. Comparison of Mishap Ship Types by HFACS Causal Factor Category. The 
number represents the percentage of mishaps in the mishap ship category that contained 
at least one instance of the corresponding taxonomy causal factor followed by the raw 

number of mishaps in parentheses. : 


Table 7 provides the distribution of causal factors among the different types of 
fatal mishaps. The "General" type of fatal mishap was most closely associated with 
inadequate supervision (90%), decision errors (60%), and infractions (60%). Man 
overboard mishaps were most closely associated with inadequate supervision (57. 1%), 
decision errors (42.9%), and adverse mental state (42.9%). Maintenance-related fatal 
mishaps were most closely associated with inadequate supervision (100%) and decision 
errors (60%). Diving mishaps, which contained very few causal factor citations (19 


total), had no particular causal factor type with which they were most closely associated. 
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% All Fatal 
Taxonomy Causal Factor Mishaps 
(n = 27) 


% General 


Unsafe Acts 
Perceptual Error 
Skill-Based Error 
Decision Error 
Infraction 
Exceptional Violation 


Unsafe Conditions 
Adverse Physiological State 
Adverse Mental State 
Mental/Physical Limitation 
Crew Resource Management 
Personnel Readiness 


Unsafe Supervision 
Unrecognized Hazardous Ops 
Inadequate Documentation 
Inadequate Design 
Inadequate Supervision 
Planned Inappropriate Actions 
Fail to Correct Problem 
Supervisory Violation 





Table 7. Comparison of Fatal Mishap Type by HFACS Causal Factor Category. The 
number represents the percentage of fatal mishaps in the mishap type category that 
contained at least one instance of the corresponding taxonomy causal factor followed by 
the raw number of mishaps in parentheses. 


D. MISHAP GROUP COMPARISONS 

A permutation test was performed to determine if there was a significant 
difference in the distribution of causal factor types between the two levels in each of the 
three groups of mishap unit facts shown previously in Table 3. The test revealed that 
there was not a significant difference between the distribution of causal factor types in all 
mishaps in Atlantic or Pacific Fleet units, or those occurring in port or at sea, or during 
the day or night. The permutation test did, however, reveal there was a significant 


difference (p < .01) between the distribution of causal factor types of the 27 fatal mishaps 
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and the 19 equipment damage mishaps (collisions, groundings, and other equipment 
damage mishaps). Complete details of the permutation test are provided in Appendix A. 
E. TEN-YEAR MISHAP FREQUENCY ANALYSIS 

The frequency of afloat class A mishaps by calendar quarter from 1987 through 
1996 is shown in Figure 6. Also shown is the number of commissioned Navy ships by 
quarter during the same period. Figure 7 shows the rate of mishaps per ship per calendar 
quarter during the same ten-year period. These results show that as the number of ships 
steadied at about 375 from 1994 through 1996, there was an average of 3.4 class A 


mishaps per year. The data used to generate Figures 6 and 7 is provided in Appendix C. 
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Figure 6. Afloat Class A Mishap Frequency per Calendar Quarter (1987 - 1996) 
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Figure 7. Afloat Class A Mishap Rate per Calendar Quarter (1987 - 1996) 
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V. SUMMARY, CONCLUSIONS AND RECOMMENDATIONS 


A. SUMMARY 

The effects of maritime mishaps, which include loss of life as well as 
environmental and economic considerations, are significant. It 1s estimated that over 80 
percent of maritime accidents are at least partially attributable to human error. Human 
error has been extensively studied in a number of fields, particularly aviation. The 
present research involves evaluation of a taxonomy, called the Human Factors Accident 
Classification System (HFACS), for applicability, reliability, and usefulness in the post 
hoc analysis of mishap investigation reports of 46 significant mishaps (i.e., involving a 
fatality, permanent disability, or equipment damage exceeding $1 million) that occurred 
on U.S. Navy ships and submarines between 1992 and 1996. HFACS was developed by 
personnel at the Naval Safety Center in Norfolk, Virginia, as an application of existing 
human error theories to accident investigation and analysis. This system has already been 
adopted by the Navy and Marine Corps for use in aviation mishap investigation and 
analysis. 

The research determined that the taxonomy supported classification of over 90 
percent of 496 causal factors cited in the reports. The remaining causal factors involved 
material and environmental issues. The reliability of the taxonomy for use in ship and 
submarine mishap analysis was evaluated by comparing the level of agreement between 
two judges with equivalent understanding of HFACS as they independently classified the 
mishaps per the taxonomy. Agreement between the two judges was determined to be 


good. 
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Differences in causal factor classification between the judges were resolved by 
consensus and the resulting classifications were used for subsequent exploratory data 
analysis. This analysis consisted of sorting the data by mishap types (fatality, 
collision/grounding, or other equipment damage) and ship type (carrier, combatant, 
auxiliary, amphibious, and other). Fatal mishaps were further sorted by type (general, 
diving, maintenance, or man-overboard). Each mishap had instances of the different 
error types, and the percentages of mishaps with each of the error types were determined. 
A significant difference was found between the types of errors cited in mishaps involving 
fatalities and those involving equipment damage only. 

B. CONCLUSIONS 

This research indicated that HFACS was indeed applicable to the analysis of 
afloat Navy mishaps. The taxonomy contained categories into which each human error 
causal factor could be classified. In some cases, causal factors cited in the mishap reports 
could have been classified equally well into more than one categories. Discussion 
between the judges revealed that this was more a criticism of the causal factor 
descriptions than a criticism of the taxonomy. There was a wide range of specificity in 
the wording of the causal factor descriptions in the mishaps reports analyzed. This is not 
to be unexpected, given that no two mishap investigation boards had the same 
membership, and the governing instructions for mishap reporting contain nothing as 
specific as the HFACS taxonomy to guide the investigation and reporting processes. _ 

The fact that a significant difference was found between the types of causal 
factors cited in fatal mishaps and equipment damage mishaps indicates that prevention 
strategies for these two broad categories of mishaps should be pursued independently. 
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Conversely, the fact that significant differences in causal factor types were not evident 
with respect to mishap unit fleet origin, physical location, or mishap time of day indicates 
that prevention strategies for these categories of mishaps should be pursued in aggregate. 
C. RECOMMENDATIONS 

To achieve greater benefit from the HFACS taxonomy, it is recommended that the 
Naval Safety Center consider leading an effort to revise the instruction governing afloat 
mishap investigation and reporting, OPNAVINST 5100.19. The revision should include 
a discussion of HFACS and provide guidance to mishap investigation boards for 
implementing HFACS as they analyze mishap circumstances. 

Post-accident analysis of mishaps involving equipment damage and those leading 
to fatalities, and the development of their intervention strategies, should be conducted 
separately. Additionally, application of HFACS to the analysis of less severe, though 
high-interest, mishaps should be ageressively pursued. Electric-shock, back injury, and 
toxic substance exposure mishap analysis should be included in this initial expansion of 
HFACS application. 

Finally, the Naval Safety Center should initiate efforts to modify their electronic 
database to better support human factor analysis of afloat mishap data. Specifically, 
entire causal factor descriptions and the corresponding HFACS taxonomy classification 


should be maintained in the database for each mishap causal factor. 
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APPENDIX A. PERMUTATION TEST DESCRIPTION 


To determine if the types of mishap causal factors identified in one grouping of 
mishaps are different from another, a permutation test (Sprent, 1989) was devised. This 
test compared a test statistic derived from the actual dichotomous groupings of mishaps 
to one derived from a randomized grouping of the same sizes from the mishap 
population. 

The 46 mishaps analyzed in this research consisted of 27 mishaps involving one 
or more fatalities or permanent total disabilities and 19 involving damage to equipment 
exceeding $1 million. To determine if there was a significant difference between the 
types of causal factors cited in these two groupings, a test statistic was computed. For 
each group of mishap types, 17 proportions representing the frequency of occurrences of 
the 17 HFACS causal factor types were computed. The test statistic was the sum of the 
squared differences of the 17 proportions between the two groups. That is, let a; 
represent the proportion of mishaps in group a in which one or more instances of HFACS 
causal factor i was cited. Let b; represent the same thing for mishap group 5. The test 


statistic is therefore equal to: 
17 
2 
2, (a;—bi) 
Calculation of this same statistic was then performed for repeated random 


samplings (without replacement) of groups of 27 and 19 from the 46 mishap population. 


A simple hypothesis test was made: 
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Null Hypothesis: 
The difference in causal factor types between fatal mishaps and 
equipment damage mishaps is no different from a random distribution 
of the 46 mishaps into one group of 27 and another of 19. 

Alternate Hypothesis: 
There is a significant difference in causal factor types for the fatal 
mishaps and equipment damage mishaps compared to random 


groupings of the incidents into sets of 27 and 19. 


The test statistic for this hypothesis is the mean number of times the actual 
statistic value 1s greater than the statistics computed for the random groupings. The 
decision rule 1s to reject the null hypothesis if this test statistic is greater than 0.975 or 
less than 0.025, representing a 0.05 level of significance. The test is two-tailed since it 
was considered unknown whether the actual grouping's statistic would be greater than or 
less than the statistic from the permutation test. 

This permutation test was applied to the research data using a function written in 
the programming language of the statistical software package S-Plus® (1997) as follows: 


function(n = 5000, df) 


Permutation Test for Comparing Two Distributions 


{ 
# 
# 
# 
# Arguments: n number of simulations 

# df data frame, 46x(17+1), 

# with the last column being 1 for 
# 

# 

# 

# 

# 

# 


fatalities and O for others. 


The statistic of interest will be sum (f; - e;)%2, where 
£; is the proportion of fatal mishaps with one or more 
occurrence of causal factor i and e; is the same 
proportion for’equipment damage mishaps. The hypothesis 


52 


He SHE HE OSE EE 


HR He HE HE HE HEHE 


$e SE OE HE HE OE 


} 


is that this statistic doesn't depend on the way the 46 
incidents are divided into groups. 


Here's the statistic of interest for the real division 
into groups. 


f.tot <- apply(df[df[, 18] == 1, -18], 2, sum) 
e.tot <- apply(df[df[, 18] == 0, -18], 2, sum) 
fl.tot <- £.tot/27 

el.tot <- e.tot/19 

baseline <- sum((el.tot - fl.tot)%*2) 

stat <- numeric(n) 


Now to sample of nineteen numbers from 1 to 46; let that 
19 be the equipment damage mishaps and the other 27 be 
fatal mishaps; and compute the statistic we would have 
seen if that were the true split. This random sampling 
is performed n times through the for loop. 


for(i in l:n) { 
samp <- sample(1:46) [1:19] 
a.tot <- apply(df[samp, -18], 2, sum) 
b.tot <- apply(df[ - samp, -18], 2, sum) 
al.tot <- a.tot/19 
bl.tot <- b.tot/27 . 
statf{[i] <- sum((al.tot - bl.tot)%*2) 


} 


Now to determine how often would one would see a 
statistic at least as big as the one we did see for the 
actual distribution of fatal mishaps and equipment damage 
mishaps. 


return (mean (baseline > stat) ) 


The "data-frame" consisted of a matrix of 46 rows and 18 columns. Each row 


corresponded to a different mishap; columns one through 17 represented the 17 causal 
factor types, and the last column was an indicator variable identifying the group to which 
the mishap belonged. A cell in column one through 17 would have a "1" in it if the 
mishap corresponding to that row had one or more citations of that causal factor type 
cited in its mishap report. The value returned by the function is the proportion of times 
the "baseline" statistic is greater than the random statistic and represents a true p-value. 


This function's code was modified by adjusting the split of the 46 mishaps in order to test 
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for significant differences between the other groupings reported in the body of this 
thesis. For example, testing for significance in the differences in causal factor types 
between mishaps occurring during the day and night involved a split of 32 daytime 


mishaps and 14 that occurred at night. 
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APPENDIX B. MISHAP DATABASE SUMMARY 


MISHAP | MISHAP DATE SHIP 
NUMBER | (YYMMDD) am SUBTYPE MISHAP SUBTYPE 
920222 









# HUMAN ERROR 
FACTORS CITED 










































































1 COMBATANT FATALITY GENERAL 

2 920310 AMPHIB FATALITY GENERAL 

3 920321 COMBATANT EQPT DAMAGE GROUNDING 
4 COMBATANT EQPT DAMAGE COLLISION 

5 AMPHIB FATALITY MAINTENANCE 
6 CARRIER FATALITY GENERAL 

7 COMBATANT FATALITY MOB 

8 AUXILIARY FATALITY GENERAL 

) 












AUXILIARY FATALITY DIVING 
OTHER EQPT DAMAGE GROUNDING 
AUXILIARY EQPT DAMAGE OTHER 
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APPENDIX C. TEN-YEAR MISHAP FREQUENCY DATA 


Calendar Cumulative # # Mishap 
5 










0.002 


1987 1 1 530 0.009 
2 531 0.009 
3 532 0.026 
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